Announcement for release 1.27 #16725

zirain · 2025-07-31T03:41:00Z

No description provided.

istio-policy-bot · 2025-07-31T03:41:04Z

😊 Welcome! This is either your first contribution to the Istio documentation repo, or
it's been a while since you've been here. A few things you should know:

You can learn about how we write and maintain documentation, our style guidelines,
and the available web site features by visiting Contributing to the Docs.
In the next few minutes, an automatic preview of your change will be built with
a full copy of the istio.io website. You can find this preview by clicking on
the Details link next to the deploy/netlify entry in the status section of this
page.
We care about quality, so we've put in place a number of checks to ensure our documentation
is top-notch. We do spell checking, sanitize the Markdown, ensure all hyperlinks point to a
valid location, and more. If your PR doesn't pass one of these checks, you'll see a red X in the
lint_istio.io entry in the status section. Click on the Details link to get a list of the
problems with your PR. Fix those problems and push an update; this will automatically re-run the
tests. Hopefully this time everything will be perfect!
Once your changes are accepted and merged into the repository, they will initially show up
on https://preliminary.istio.io. The changes will be published to https://istio.io
the next time we do a major release (which typically happens every 3 months or so).
To publish them sooner, add a cherrypick/release-x.xx label, where x.xx is the current
release of Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

content/en/news/releases/1.27.x/announcing-1.27/_index.md

dhawton

Partial pass on release notes, will continue reviewing later.

.spelling

content/en/news/releases/1.27.x/announcing-1.27/change-notes/index.md

dhawton

Finished first pass over the change notes.

content/en/news/releases/1.27.x/announcing-1.27/change-notes/index.md

sridhargaddam · 2025-08-05T09:41:20Z

content/en/news/releases/1.27.x/announcing-1.27/change-notes/index.md

+
+- **Added** support for native `nftables` when using Istio sidecar mode. This update makes it possible to use `nftables`
+  instead of iptables to manage network rules, offering more efficient approach to traffic redirection for pods and
+  services. To enable the `nftables` mode, use `--set values.global.nativeNftables=true` at the time of installation.  ([Issue #56487](https://github.com/istio/istio/issues/56487))


Should we add a note here that only debug images currently support this mode?

PS: Following is the tracker for including the nftables-slim in distroless images - istio/istio#57237

A note for future, that should be part of the release notes yaml in the PR.

content/en/news/releases/1.27.x/announcing-1.27/_index.md

craigbox

Sorry, forgot to sent this yesterday

content/en/news/releases/1.27.x/announcing-1.27/upgrade-notes/index.md

craigbox · 2025-08-03T10:11:31Z

content/en/news/releases/1.27.x/announcing-1.27/upgrade-notes/index.md

+## Multiple certificate types support in Gateway
+
+Istio now supports configuring multiple certificate types (such as RSA and ECDSA) simultaneously in Gateway resources.


Classic Gateway or Kubernetes Gateway?

Added Add support for multiple server certificates in gateway (istio & gateway api)

it seems like to be both for the release notes.

yes. it is both

data/compatibility/supportStatus.yml

content/en/news/releases/1.27.x/announcing-1.27/_index.md

ericdbishop · 2025-08-06T17:26:03Z

content/en/news/releases/1.27.x/announcing-1.27/change-notes/index.md

+- **Added** certificate revocation list (CRL) support for plugged-in CAs, enabling Istio to watch for `ca-crl.pem` files and
+  automatically distribute CRLs across all namespaces in the cluster. This enhancement allows
+  proxies to validate and reject revoked certificates, strengthening the security posture of service mesh deployments
+  using plugged-in CAs.  ([Issue #56529](https://github.com/istio/istio/issues/56529))


Should this point to istio/istio#56308 where the design doc is referenced?

this's generated from the release notes in istio/istio, I'm fine if you want to highlight the design doc.

We also don't link to pull requests, only issues. It's best to put design docs in the issue.

There is no obvious issue; the issue linked is for something after the fact. 56529 didn't tell me anything; I had to work backwards to figure out what the thing was.

At least, it linked to the implement PR, and there's a design in the PR description.

content/en/news/releases/1.27.x/announcing-1.27/_index.md

keithmattix · 2025-08-08T20:50:44Z

@istio/release-managers-1-27 Something I just ran into: after istio/istio#56048, using an older istioctl or helm chart version with new istio-cni images will cause ambient enablement to break completely because the defaults are set in the install mechanism. Maybe something to call out in release notes? Maybe it's too much, but it took me a while to debug so I figured I'd bring it up.

Sidenote: we may want to consider patching the istio-cni code itself so that the default doesn't result in ambient being unusable...probably a good thing to target for a 1.27.1 release?

howardjohn · 2025-08-08T21:05:15Z

@istio/release-managers-1-27 Something I just ran into: after istio/istio#56048, using an older istioctl or helm chart version with new istio-cni images will cause ambient enablement to break completely because the defaults are set in the install mechanism. Maybe something to call out in release notes? Maybe it's too much, but it took me a while to debug so I figured I'd bring it up.

Sidenote: we may want to consider patching the istio-cni code itself so that the default doesn't result in ambient being unusable...probably a good thing to target for a 1.27.1 release?

I've run into the same but its a 100% invalid way to install Istio which has been broken for ~80% of versions (usually broken in different ways) so its not a new thing. I have also ran into this exact CNI issue and struggled to debug, though since I often pull latest

.spelling

content/en/news/releases/1.27.x/announcing-1.27/_index.md

.spelling

content/en/news/releases/1.27.x/announcing-1.27/_index.md

craigbox · 2025-08-11T10:17:24Z

content/en/news/releases/1.27.x/announcing-1.27/change-notes/index.md

+- **Added** certificate revocation list (CRL) support for plugged-in CAs, enabling Istio to watch for `ca-crl.pem` files and
+  automatically distribute CRLs across all namespaces in the cluster. This enhancement allows
+  proxies to validate and reject revoked certificates, strengthening the security posture of service mesh deployments
+  using plugged-in CAs.  ([Issue #56529](https://github.com/istio/istio/issues/56529))


There is no obvious issue; the issue linked is for something after the fact. 56529 didn't tell me anything; I had to work backwards to figure out what the thing was.

content/en/news/releases/1.27.x/announcing-1.27/_index.md

linux-foundation-easycla · 2025-08-11T11:56:03Z

The committers listed above are authorized under a signed CLA.

✅ login: zirain / name: zirain (3077597)

dhawton · 2025-08-11T12:21:35Z

/test easycla

istio-testing · 2025-08-11T12:21:38Z

@dhawton: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test doc.test.dualstack

/test doc.test.multicluster

/test doc.test.profile-ambient

/test doc.test.profile-default

/test doc.test.profile-demo

/test doc.test.profile-minimal

/test doc.test.profile-none

/test gencheck

/test lint

The following commands are available to trigger optional jobs:

/test update-ref-docs-dry-run

Use /test all to run the following jobs that were automatically triggered:

gencheck_istio.io

lint_istio.io

update-ref-docs-dry-run_istio.io

In response to this:

/test easycla

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

dhawton · 2025-08-11T12:21:51Z

/easycla

content/en/news/releases/1.27.x/announcing-1.27/_index.md

zirain · 2025-08-11T12:25:25Z

what happen to [email protected]?

dhawton

Couple nits

content/en/news/releases/1.27.x/announcing-1.27/change-notes/index.md

content/en/news/releases/1.27.x/announcing-1.27/_index.md

content/en/news/releases/1.27.x/announcing-1.27/upgrade-notes/index.md

dhawton · 2025-08-11T12:31:17Z

what happen to [email protected]?

Nothing. That's still my primary GH email address. Not sure what error easycla is having, nothing has changed irt my GH account in several years. Seems to also not like a commit co-authored by Keith.. so easycla/GH issue maybe? or it's not us.

zirain · 2025-08-11T12:35:21Z

what happen to [email protected]?

Nothing. That's still my primary GH email address. Not sure what error easycla is having, nothing has changed irt my GH account in several years. Seems to also not liking a commit co-authored by Keith.. so easycla/GH issue maybe? or it's not us.

it happen after I merged master, so I think it might not from our side.

dhawton · 2025-08-11T12:39:49Z

Ah yes.. the commit has "2 people and zirain" and the first of the "2 people" is an invalid zirain profile. So something isn't right in those commits.

zirain · 2025-08-11T12:55:24Z

Ah yes.. the commit has "2 people and zirain" and the first of the "2 people" is an invalid zirain profile. So something isn't right in those commits.

if you don't mind, let me merge them all into one commit to pass it?

zirain · 2025-08-11T14:39:49Z

/easycla

zirain requested review from a team as code owners July 31, 2025 03:41

istio-testing added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 31, 2025

zirain commented Jul 31, 2025

View reviewed changes

content/en/news/releases/1.27.x/announcing-1.27/_index.md Outdated Show resolved Hide resolved

zirain mentioned this pull request Jul 31, 2025

Prepare Istio 1.27 release istio/istio#56709

Closed

52 tasks

dhawton reviewed Jul 31, 2025

View reviewed changes

sridhargaddam reviewed Aug 5, 2025

View reviewed changes

sridhargaddam reviewed Aug 6, 2025

View reviewed changes

content/en/news/releases/1.27.x/announcing-1.27/_index.md Outdated Show resolved Hide resolved

craigbox reviewed Aug 6, 2025

View reviewed changes

keithmattix reviewed Aug 6, 2025

View reviewed changes

content/en/news/releases/1.27.x/announcing-1.27/_index.md Outdated Show resolved Hide resolved

ericdbishop reviewed Aug 6, 2025

View reviewed changes

sridhargaddam reviewed Aug 7, 2025

View reviewed changes

content/en/news/releases/1.27.x/announcing-1.27/_index.md Outdated Show resolved Hide resolved

craigbox reviewed Aug 11, 2025

View reviewed changes

zirain force-pushed the release-notes-1.27 branch from 3e436e4 to 631aaa8 Compare August 11, 2025 12:18

zirain requested review from craigbox and dhawton August 11, 2025 12:18

dhawton reviewed Aug 11, 2025

View reviewed changes

content/en/news/releases/1.27.x/announcing-1.27/_index.md Outdated Show resolved Hide resolved

dhawton reviewed Aug 11, 2025

View reviewed changes

merge all commit to fix CLA

3077597

zirain force-pushed the release-notes-1.27 branch from 847b47f to 3077597 Compare August 11, 2025 15:35

craigbox approved these changes Aug 11, 2025

View reviewed changes

istio-testing merged commit 315487e into istio:master Aug 11, 2025
6 checks passed

zirain deleted the release-notes-1.27 branch August 11, 2025 20:37

		## Multiple certificate types support in Gateway

		Istio now supports configuring multiple certificate types (such as RSA and ECDSA) simultaneously in Gateway resources.

Announcement for release 1.27 #16725

Announcement for release 1.27 #16725

Uh oh!

Conversation

zirain commented Jul 31, 2025

Uh oh!

istio-policy-bot commented Jul 31, 2025

Uh oh!

Uh oh!

dhawton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dhawton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dhawton Aug 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

craigbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

keithmattix commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

howardjohn commented Aug 8, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dhawton Aug 5, 2025 •

edited

Loading

keithmattix commented Aug 8, 2025 •

edited

Loading

linux-foundation-easycla bot commented Aug 11, 2025 •

edited

Loading

dhawton commented Aug 11, 2025 •

edited

Loading